Copy link to clipboard
Copied
Hello all,
I have an application running on CF9 and there are many Custom Tags and CFC files - that some are calling directly. For example, somehow a bot found one and now it tries to index it as a direct URL.
http://www.yourdomain.com/my-custom-tag.cfm
How do I stop any direct URL access to a CT or CFC - and only allow the CT to run when called?
Copy link to clipboard
Copied
Not storing them in the web root would be the first thing. Is there a reason they need to go in the webroot?
If they must be there, then put them in a sub folder which is only accessible by the CF service, if anyone else navigates to them it will give them a 401/3
Copy link to clipboard
Copied
Sorry - they are not in the web root - they are in their own folder and available to all websites on the server.
Copy link to clipboard
Copied
We avoid using custom tags but some of our legacy tags have code similar to the following:
<cfif NOT thisTag.hasEndTag>
<cfabort showerror="You need to supply a closing <CF_Head> tag.">
</cfif>
<cfif thisTag.executionMode EQ "end">...
You may be able to simply check for the existence of thisTag - isDefined("thisTag").
Another option is updating your application.cfm or application.cfc to white list the templates that can be accessed from the outside world. You can do the same via folders and access permissions similar to what haxtbh mentioned - but restructuring your app may be more difficult than <cfif NOT listFindNoCase("big.cfm,ugly.cfm,list.cf,of.cfm,files.cfm",cgi.script_name)><cfabort showerror="Go away!" /></cfif>
Copy link to clipboard
Copied
csgaraglino wrote
http://www.yourdomain.com/my-custom-tag.cfm
How do I stop any direct URL access to a CT or CFC - and only allow the CT to run when called?
You could just use the settings in your web-server to deny access to the URL.